CVE-2026-86734
Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 8, 2026
- Updated
- Sep 10, 2026
- Reserved
- Sep 8, 2026
Description
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
snipe-itgrokability |
|
References
- GitHub Security Advisory (GHSA-4vcv-fc5x-jjwv)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Fieldthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.